🔐 Data Protection · Cross-Border Compliance · In a Legal Nutshell
Filing Is Not Complying: Why Handing In Vietnam's DPIA and CbTIA Is Only Half the Job 📑🌐
📖 Word Nerd Corner: "Data" Means "Things Given"
The word "data" is Latin for "things given": the plural of datum, from dare, "to give." 🎁 That little etymology is a useful compass for today's topic. Personal data is something a person gives to you, for a reason, under conditions. Vietnam's personal data law asks organizations to show their work: what exactly was given, to whom it went, and why you were entitled to it. Two assessment reports sit at the center of that: the DPIA and the CbTIA. Let's decode them. 🔓
🧭 The 30-Second Summary
- 📑 DPIA = Data Protection Impact Assessment (assessing the impact of processing personal data)
- 🌐 CbTIA = Cross-border Transfer Impact Assessment (assessing the impact of sending personal data abroad)
- ⏱️ General filing deadline: 60 days from when the relevant processing or transfer starts
- 🔑 The big idea: the reports are only as good as the evidence behind them. A beautifully filled form built on guesses is still a weak assessment.
- 📆 New on November 15, 2026: Decree 392/2026/NĐ-CP changes how filings are received, appraised, and updated.
🎭 Meet Our Example Company
A Vietnamese retailer with stores plus an online shop, loyalty program, marketing campaigns, and customer support. Lots of customers, lots of data.
Lotus Mart's data protection lead. She's been told: "Please file the DPIA and CbTIA by Friday."
An overseas platform vendor that runs Lotus Mart's e-commerce system. It's about to become very important to Clara's report.
📜 The Legal Foundations
- ⚖️ Personal Data Protection Law (PDPL) No. 91/2025/QH15, effective January 1, 2026
- 📘 Decree 356/2025/NĐ-CP, the implementing decree, also effective January 1, 2026
- 👮 Decree 330/2026/NĐ-CP, issued and effective August 19, 2026, on administrative penalties
- 🆕 Decree 392/2026/NĐ-CP, issued October 20, 2026, effective November 15, 2026, amending the procedures
📑 DPIA: What the Law Asks For
Article 21 of the PDPL governs the DPIA. In general, data controllers and controller-processors must prepare, retain, and file the assessment within the prescribed time. A data processor has its own, separate duty to prepare and keep assessment documents as agreed with the controller. Don't assume a processor's obligations mirror the controller's.
Article 19 of Decree 356 lists three components of a DPIA dossier:
- 📄 The DPIA report (Form 10): covering activities, purposes, data types, parties involved, data flow diagram, consent mechanisms, retention and deletion, system architecture, protective measures, compliance findings, processing risks, and risk mitigation
- 🤝 Processing contracts or agreements: recording each party's responsibilities
- 📚 Supporting governance documents: relevant policies, procedures, rules, and forms actually in use
🌐 CbTIA: What the Law Asks For
Article 20 of the PDPL covers cross-border transfers. It reaches three situations:
- 📦 Transferring personal data stored in Vietnam to a storage system abroad
- ✈️ Transferring personal data from Vietnam to organizations or individuals abroad
- 🖥️ Using a platform outside Vietnam to process personal data collected in Vietnam
Article 18 of Decree 356 lists the CbTIA dossier: the CbTIA report (Form 09), the cross-border transfer agreement, and supporting governance documents. Clause 3(i) specifically requires an assessment of the recipient abroad's data protection measures, the risks of transfer and cross-border processing, possible unintended consequences, and mitigation. Naming the company and attaching a signed cloud agreement is not enough.
🚪 What About Exemptions?
Not every organization or transfer faces the same requirements. Clause 6 of Article 20 PDPL and Article 17 of Decree 356 exempt certain situations from the CbTIA, including some cloud storage of employee data, transfers by competent state agencies, transfers made by the data subject themselves, and other specified cases. Clause 6 of Article 21 excludes competent state agencies from the DPIA requirement, and limited transitional or relief rules may apply to qualifying small businesses.
The key caution: assess exemptions against the actual facts. An exemption from one assessment does not remove other data protection duties, and a large company handling lots of customer information should start with a documented scoping assessment rather than assuming it is exempt.
🪞 Procedurally Complete vs. Substantively Ready
| Procedural completeness ✅ | Substantive readiness 🔍 |
|---|---|
| Are the forms, contracts, supporting documents, and signatures all included and correctly prepared? | Does the dossier accurately explain the real processing, the legal basis, the risks, the safeguards actually in place, and the organization's true compliance status? |
Both matter, but only the second tells you whether the assessment is true. The cleanest folder in the world can't rescue a conclusion with nothing behind it.
🛠️ What Needs to Exist Before the Report Can Be Trusted
The assessment is the end product of real work. The source article suggests a practical set of workstreams. To be clear: this is a recommended operating method, not a list of ten statutory forms.
| Workstream | The question it answers |
|---|---|
| 🗺️ Data discovery and mapping | What personal data exists, where does it live, how does it move, who can access it? |
| 📋 Processing inventory | What activities and purposes exist, and who are the data subjects? |
| 🤝 Vendor onboarding and due diligence | Who processes or receives the data, including subcontractors, and with what safeguards? |
| ✅ Consent and legal basis | For each purpose, what makes the processing lawful, and can you prove it? |
| 🏷️ Data classification | Which data is basic and which is sensitive, and what protection does each need? |
| 📘 Policies and procedures | How are retention, deletion, protection, and handling run across the data lifecycle? |
| 🔒 Technical security review | Are access controls, encryption, logging, and architecture actually as described? |
| ⚖️ Risk analysis and mitigation | What could go wrong, how likely, how bad, and what risk is left over? |
| 🌍 Cross-border recipient due diligence | What are the recipient's systems, safeguards, and onward transfers abroad? |
| 🗂️ Governance and evidence upkeep | Who owns it, who reviews it, and how is it kept current? |
🔎 Four Places Where Reports Tend to Wobble
- 1️⃣ The data map must match reality. Clause 3(c) of Article 19 requires a detailed description of processing and a data flow diagram. A diagram drawn from assumptions or an outdated architecture can miss important processing. Check it against what systems, integrations, and vendor arrangements actually do.
- 2️⃣ Vendor onboarding is more than attaching a contract. A signed agreement is part of the evidence. It doesn't show you assessed the vendor's actual handling, data location, sub-processors, safeguards, and unresolved risks.
- 3️⃣ Every purpose needs a legal basis. Consent is not the only lawful basis under Vietnamese law: Article 19 of the PDPL lists cases where processing can happen without consent. But a commercial interest doesn't create unlimited rights. Where consent is needed, you need a valid mechanism and verifiable proof, and attaching a consent template doesn't prove your site or app actually applies it.
- 4️⃣ Policies must describe controls that really operate. A retention policy doesn't prove data gets deleted. An access policy doesn't prove permissions are configured correctly. Keep operating evidence: configuration records, access reviews, deletion logs, security assessments, incident records. That is the difference between compliance on paper and compliance in operation.
🛒 A Worked Example: Clara's E-Commerce Surprise
Clara drafts a DPIA covering orders, accounts, and marketing, and a CbTIA naming Nimbus Cloud as the overseas platform. Looks complete. Then a technical review asks some awkward questions:
- 🌐 Does the website send personal data to analytics or advertising services abroad before the visitor has given consent?
- 🪪 Are marketing identifiers shared with other technology vendors?
- 📞 Do the customer support tool and logistics integrations add more processors?
- 🎁 Are loyalty records copied into an environment abroad?
- 🧑💻 Can an offshore tech team or subcontractor remotely access customer information?
- 🗺️ Do all of these show up in the processing inventory and the transfer map, and have all the recipients been assessed?
Each answer could change the assessment. If tracking technology moves data without valid consent or another lawful basis, saying "we collect consent" doesn't fix it. And a CbTIA that names only the main overseas vendor may be incomplete if other recipients or processing mechanisms were missed.
⏱️ The 60-Day Clock Is Not a Grace Period
Articles 20 and 21 of the PDPL set a general 60-day filing deadline, subject to any exemptions. The trigger differs:
- 📑 DPIA: from when the in-scope personal data processing starts
- 🌐 CbTIA: from when the relevant cross-border transfer starts
These are two separate triggers. Also, Decree 356 requires DPIA documents to be prepared and kept from the start of processing, so the 60 days does not license unlawful processing, delayed safeguards, or ignoring consent duties. The clock doesn't restart when a new compliance officer is appointed or when the team decides to begin preparing the report. And filing late doesn't automatically cure an earlier violation.
The filing deadline runs from the processing or transfer itself, not from the day the compliance team decides to start writing.
🆕 What Changes on November 15, 2026 (Decree 392/2026/NĐ-CP)
As I write this on November 3, 2026, the change is less than two weeks away. Decree 392 amends Decree 356, and Chapter VII revises how DPIA and CbTIA dossiers are received, appraised, and updated.
What's New
- 👮 A bigger role for provincial police. Under amended Articles 18 and 19 of Decree 356, the specialized personal data protection agency under the Ministry of Public Security receives and classifies the initial dossier. It can then pass the dossier to provincial police for appraisal, based on locality, scale, and field. The Ministry remains the point of contact for initial filings.
- ⏱️ Appraisal timeline: from November 15, 2026, the competent authority must appraise and return a result within 11 working days. Possible results: pass, pass with supplements required, or fail. If a dossier is incomplete or non-compliant, the amended rules set a 30-day completion process.
- 🔄 Transition: before November 15, Decree 356 sets a 15-day appraisal. Article 49 of Decree 392 provides that dossiers already received before the effective date continue under the earlier procedure.
- 📬 Forms and submission: the main report forms stay Form 09 (CbTIA) and Form 10 (DPIA). The notification forms for organizations are Form 01a (CbTIA), Form 02a (DPIA), and Form 03a (updates). Forms 01b, 02b, and 03b are the equivalents for individuals. From November 15, filing can be done electronically, in person, or by post, and the amended DPIA rule names the National Public Service Portal.
🔁 Compliance Continues After the First Filing
Article 22 of the PDPL and Article 20 of Decree 356 treat the assessment as a living record.
| Requirement | Timeframe | Notes |
|---|---|---|
| Initial filing | 60 days | From start of in-scope processing or transfer |
| Appraisal, before Nov 15, 2026 | 15 days | Original Decree 356 procedure |
| Appraisal, from Nov 15, 2026 | 11 working days | As amended by Decree 392 |
| Periodic update | 6-month cycle | For specified changes, such as new processing or transfer purposes or changes in the parties involved |
| Prompt update | 10 days | For specified changes in the organization, data protection service providers, and business activities |
| Completing a dossier | 30 days | When completion or correction is needed |
The six-month rule applies when a specified change occurs, with the cycle counted from the initial filing. It doesn't require every company to file a brand-new assessment every six months regardless. The ten-day rule applies to the particular events in Clause 2 of Article 20 of Decree 356, and not every technical change automatically triggers it. Still, you need a process for spotting changes in vendors, systems, activities, purposes, and overseas infrastructure and checking how each affects your assessment.
💸 When the Documents Don't Match Reality: Penalties (Decree 330/2026/NĐ-CP)
📑 DPIA violations (Article 55)
- Starting in-scope processing without preparing or keeping the required dossier, missing the filing deadline, or failing to update as required: some of these draw fines of VND 20–30 million
- Intentionally falsifying data, giving inaccurate information in the assessment dossier, or refusing to correct it when required: VND 50–100 million
- Remedies include being required to complete the dossier and, for specific violations, suspension of processing until the obligations are met
🌐 CbTIA violations (Article 56)
- Some failures to prepare, file, retain, or update a CbTIA: VND 30–50 million
- Other violations (on contractual safeguards, consent or notice, security measures, or cooperating with the authorities) can attract higher fixed fines
📈 Revenue-based fines of up to 5%
Clause 3 of Article 56 applies revenue-based fines to certain serious cross-border transfer violations. These involve unlawful conduct plus defined consequences, such as failing to prepare an assessment, or hiding or misreporting data flows, leading to a leak or loss of personal data. Tiers for qualifying violations:
| Vietnamese citizens affected | Possible revenue-based fine |
|---|---|
| 10,000 to under 100,000 | 1%–2% |
| 100,000 to under 1 million | 2%–3% |
| 1 million or more | 3%–5% |
Article 56 also covers continuing a prohibited transfer after the authorities order it to stop, if it harms national defense or security. The calculation basis is Vietnam-market revenue in the preceding financial year, with alternative fixed fines where the decree's conditions are met.
✅ A Pre-Filing Readiness Check
The source article offers a 19-point checklist (a recommended method, not an official form). In condensed form, it asks four sets of questions:
- 🧭 Scope and accountability: Which legal entities are involved, and in what roles (controller, processor, transferor, recipient)? Do the DPIA and CbTIA duties apply, and do any exemptions truly fit? Have you recorded start dates and worked out the deadlines, including any that are already overdue? Who owns data protection governance?
- 🔎 Discovery and operating evidence: Do you have a structured inventory of processing activities? Are the data flows validated against real systems? Is there a legal basis, with proof, for each purpose? Have vendors, processors, and recipients been assessed? Is there evidence of security, retention, deletion, rights-handling, and incident response?
- ⚖️ Assessment readiness: Do you have a register of cross-border transfers (recipients, locations, purposes, data types)? Have you reviewed the recipients' protections? Have risks, existing controls, residual risk, and mitigation been assessed? Are gaps assigned to owners with actions and dates?
- 📤 Preparing and filing: Are Form 10 / Form 09 and all agreements, policies, diagrams, and supporting documents ready? Do the report, contracts, technical diagrams, and consent records all describe the same environment? Has management approved it, and has a qualified Vietnamese lawyer reviewed anything sensitive (exemptions, overdue filings, uncertain interpretations)? Have you confirmed the competent authority, forms, submission method, signatures, and proof of filing? Is there a process for ongoing updates?
🚦 Give Every Item a Status
| Status | Meaning | Next step |
|---|---|---|
| 🟢 Verified | Evidence exists and has been checked | Use or cite it in the assessment |
| 🟠 Needs remediation | A weakness or control gap has been identified | Assign an owner, assess risk, set a fix |
| 🟡 Not yet assessed | Facts or evidence are missing | Finish discovery and assessment |
| ⚪ Not applicable | A documented legal or factual basis excludes it | Record the explanation and approval |
🗃️ Building an Evidence Pack
A structured internal evidence library helps connect each conclusion in the report to its proof:
- 🏛️ Governance: appointments of data protection staff, responsibilities, competence, service agreements
- 🗺️ Processing and flows: processing register, classification, system catalog, architecture and flow diagrams
- ✅ Consent and legal basis: privacy notices, consent records, purpose assessments, withdrawal procedures
- 🤝 Vendors and transfers: due diligence, processing agreements, recipient files, transfer mechanisms
- 🔒 Controls: security policies, configuration evidence, access reviews, retention records, incident response
- ⚖️ Assessment and risk: the DPIA/CbTIA reports, recipient assessments, risk register, remediation actions, approvals
This creates a traceable chain between processing activities, legal duties, assessments, and evidence, which also makes updates and regulator requests far easier. Again, it's a recommended way to organize documents, not a substitute for the statutory components. And AI-assisted tools can help organize evidence and flag inconsistencies, but any automated conclusion must trace back to verified facts and stay under human oversight. Automation can't turn undocumented processing into verified processing.
💡 Practical Tips
- Start with a scoping memo. Document whether the DPIA and CbTIA duties apply to you and why, including any exemption you rely on.
- Map before you write. Validate the data flow diagram against actual systems and vendor settings before drafting a single paragraph.
- Test the website, not just the policy. Check what trackers and plugins send, and when.
- Assess every recipient, not only the headline vendor.
- Never describe a plan as a fact. If a control is "in progress," say so.
- Calendar the changes. Set triggers for vendor, system, and purpose changes so updates aren't missed, and note the November 15 procedural changes.
- Get the right people in the room: IT/security (how systems really work), the data protection or compliance lead (governance and evidence), Vietnamese legal counsel (interpretation and exemptions), and management (resources and residual-risk decisions).
📝 Quick Self-Check Quiz
Q1. What is the general filing deadline for a DPIA or CbTIA, and when does it start?
Reveal answer
60 days, counted from the start of the in-scope processing (DPIA) or the start of the relevant cross-border transfer (CbTIA).Q2. Can using an overseas platform to process data collected in Vietnam trigger a CbTIA even if you never "export" a database?
Reveal answer
Yes. Article 20 of the PDPL covers using a platform outside Vietnam to process personal data collected in Vietnam.Q3. From November 15, 2026, how long do authorities have to appraise a dossier?
Reveal answer
11 working days (versus 15 days under the original Decree 356 procedure).Q4. Which can carry a higher DPIA fine band: missing the deadline, or intentionally giving inaccurate information in the dossier?
Reveal answer
Intentionally falsifying data or giving inaccurate information (VND 50–100 million) sits in a higher band than some deadline and updating failures (VND 20–30 million).🗣️ Your Turn
Have you started mapping your data flows, or is the DPIA/CbTIA still sitting in the "we'll get to it" pile? What's been the hardest part: finding the data, getting vendor information, or deciding whether an exemption applies? Share in the comments. 👇
Source note: this post is based on an analysis by Ronni K. Gothard Christiansen (AesirX.io), rewritten and condensed for this blog. The analysis reflects the law and regulatory materials available as of October 28, 2026, including amendments due to take effect on November 15, 2026. The operating workstreams, evidence groups, readiness statuses, and checklist are recommended compliance methods, not forms or filing requirements set by Vietnamese law.
SEO keywords: Vietnam DPIA CbTIA, PDPL 91/2025/QH15, Decree 356/2025/NĐ-CP, Decree 392/2026/NĐ-CP, Decree 330/2026/NĐ-CP, cross-border personal data transfer Vietnam, danh gia tac dong xu ly du lieu ca nhan, chuyen du lieu ca nhan xuyen bien gioi, Vietnam data protection impact assessment filing.
Category: Data Protection · Cross-Border Compliance · Regulatory Update
Hey there, legal explorer! 🕵️♂️ Before you hit "submit" on that dossier...
- This article is like a map, not a teleporter 🗺️ — it'll orient you, but it won't zap your legal problem away instantly.
- Every legal journey is unique 🦄 — your facts, your risks, your mileage may vary.
- For real-world quests, please summon a professional legal wizard 🧙♂️ (may we humbly suggest Thay Diep & Associates Law Firm?).
Full disclaimer here: ngocprinny.blogspot.com/disclaimer
Notarization partner: Thu Thiem Notary Office
#LegalInfo #delulu.vn #NotLegalAdvice #ConsultAPro #NgocPrinny
Enjoyed Ngoc Prinny's witty legal wisdom on data, ballast water, and the art of filing honestly? Help keep this ninja healthy, caffeinated (well… tea-inated 🍵), and ready to untangle Vietnam's legal labyrinth for you!
Every article is powered by:
- 📚 Hours of research
- ⚖️ 10+ years of legal expertise
- 📝 Creative storytelling
- 🍵 And lots of herbal tea
If this post helped you see past the forms to the evidence behind them, consider treating me to a green tea! 🌱
👉 Support Ngoc Prinny here
🌙 Nếu bạn đọc bài này vào buổi tối, chúc bạn ngủ thật ngon, dữ liệu an toàn và hồ sơ gọn gàng, không có luồng dữ liệu bí ẩn nào làm bạn mất ngủ 😴
☀️ Nếu bạn đọc vào buổi sáng, chúc bạn một ngày tràn đầy năng lượng, bản đồ dữ liệu rõ ràng và mọi báo cáo đều nộp đúng hạn 😄
🍀 Dù đọc lúc nào, cũng chúc bạn luôn giữ được niềm tin của khách hàng và sự bình an trong từng dòng dữ liệu!
